Get My Score

National Cybersecurity Awareness Month (NCSAM) - Week 3

azure outage

It’s Everyone’s Job to Ensure Online Safety at Work

This week’s NCSAM theme is ‘It’s Everyone’s Job to Ensure Online Safety at Work.”  Basically, it means that you need to take personal responsibility to ensure your CyberPosture.  Why is this so critical, and why do smaller businesses have to take additional precautions?  In many cases, these organizations have less of a budget or skillset to implement security-in-depth, and their employees may think that they are too small a target.  But, with larger organizations more apt to take proper precautions, the SME space becomes a ripe hunting ground.  The sad thing is that a single major breach is much more likely to put a smaller company out of business or tarnish their reputation to an extent that requires a long road to recovery.  In fact, 61% of SMEs experienced a cyberattack in 2017, but only 21% considered their ability to respond to be effective.

Over the last year, at Cavirin we’ve written plenty about ‘the enemy within’ as well as verticals that are the most vulnerable to employee carelessness.  Have we made any progress?  Unfortunately, it looks as if we’re heading in the opposite direction.  A Ponemon study released in the spring of this year states that the number of incidents per organization involving employee or contractor negligence has increased from 10.5 to 13.4 times per year since 2016. 

Overall, negligence, and not malicious intent or hacking, was the cause of 64% of breaches, impacting every vertical, with financial, services, industrial, energy, and healthcare the top five.  Each resulting breach cost an average of $283K, for a total of $3.8M per organization.  The table below breaks this out in additional detail.  But, where it really gets interesting is the impact of how long it takes to identify and remediate the breach.

 

cost for security breaches

If identified early, the total exposure is about 2/3 less than those that take three months or more to address.  How does one identify the breach quickly?  More on this in a bit!

 

cost for insider data breaches

Note:  This table includes malicious behavior and credential theft, for a median of $8.5M vs the $3.8M stated earlier, but the overall trend is the same.

How else might we be losing ground?   I hate to admit it, but my home state of California is one of the worst offenders.  I don’t know if it is complacency or the fact that we are surrounded by so much tech, but based on a recent study, also by Ponemon, we are the 6th worst state at -3.05 as it relates to our cyber hygiene, our personal CyberPosture.  The folks in New Hampshire must be doing something right!

 

most secure states, least secure states

More telling than just a number, are the actions taken by those with ‘good’ cyber hygiene, vs those without.  This includes backing up data, keeping software up to date, bank statement monitoring, and other obvious actions listed in the table below.

security best practices

 

So what can you do to immediately improve your cybersecurity posture?  The table above applies equally well to individuals as well as businesses.   Within the organization, one of the most fundamental tasks of IT is to ensure that laptops and servers are updated and backed-up automatically, encryption is in place, firewalls are active, and proper password hygiene is enforced.  Unfortunately, this is not always the case.  And, employee training is sometimes very nebulous, but one action that has an immediate impact is anti-phishing training.  Many IT departments also clearly identify any email from a source outside of the organization. 

One potential area of added threat is the employee with their BYOD iPhone or Android phone.  SMEs are less likely to implement device management software, and this presents a problem.  It just takes one employee, wanting to up-level their Fortnite creed, or tricked into downloading a fake Google Play Store, to bypass Android security and potentially compromise the entire organization.  Without any controls in place, these threats are incredibly hard to track…. until it is too late.

Last but not least, how do we ensure quicker discovery of any breach, with a goal of minimizing damage?  Looking back at the data on the escalating cost of a breach the longer it goes uncorrected, or how to identify a BYOD threat in less than a Fortnite, a solution is to deploy a platform to continually assess the organization’s CyberPosture.  This includes both servers, if the SME controls any, either on-prem or in the cloud, as well as that of their cloud provider.  Cavirin’s CyberPosture Intelligence provides just such as solution, not only for SMEs, but for enterprises and MSSPs of all sizes.

 

Additional resources:

StaySafeOnline (NCSA)

Cybersecurity Resources Road Map (CERT)

Cybersecurity for Startups (CERT)

 

 

 

0
0
0
s2sdefault

© 2018 Cavirin Systems, Inc. All rights reserved.